CVE-2026-63166
MEDIUM
MEDIUM
Priority: 0.00
BB Relevance:
61/100
Published: 2026-11-13
Modified: 2026-11-13
First seen: 2026-11-13
Status: active
Attack Surface
Network
Low Complexity
No Auth
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
None
UI:
Passive
S:
X
AT:
None
VC:
None
VI:
None
VA:
None
Description
Omnispace Agora Project through 26.10.0 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious HTML markup by controlling imported directory data or an uploaded CSV file, as values are rendered into table cell text and value attributes after only Txt::utf8Encode() with no HTML escaping in VuePersonsImportExport.php. Attackers can craft a CSV cell containing an attribute-breakout payload that is rendered verbatim and executed in the browser of the administrator performing the import, leading to arbitrary script execution in the administrative context.
Weakness Classification (1)
Affected Software (2)
| Vendor | Product | Version |
|---|---|---|
| Omnispace | Agora Project | 0 |
| Omnispace | Agora Project | 0 |
References & Advisories (3)
third-party-advisory
product